Lines of code #L31-#L75

Vulnerability details

Impact

Anyone can call the perform function. It can lead to unauthorized changes in the security council.

Proof of Concept

There is no access control in the perform function and it is marked “external”.

function perform(address _securityCouncil, address[] memory _updatedMembers, uint256 _nonce)
external
returns (bool res)
{

Anyone can call the perform function and update members of the security council.

Tools Used

Manual review

Recommended Mitigation Steps

Use an access control contract such as OpenZeppelin’s AccessControl.

Assessed type

Access Control

The text was updated successfully, but these errors were encountered:

All reactions